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Confidential Communication 
Via Federal Express 


Office of the Attorney General 
Supreme Court Building 
207 W. High St. 

P.O. Box 899 
Jefferson City, MO 65102 

Re: Data Breach Notification 

Dear Attorney General: 

In accordance with Mo. Rev. Stat. § 407.1500 et seq., we are sending this letter to inform you 
of a data breach involving information of current and former employees of the law firm of McKenna 
Long & Aldridge LLP, which was stored and maintained by an outside vendor. 

Please find enclosed a sample of the notification that was sent to Missouri residents on 
February 27, 2014. 


Very truly yours, 



Raymond O. Aghaian 


ROA/JAS 


Enclosure 
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February 26, 2014 


Dear [NAME], 

McKenna Long & Aldridge (“MLA”) recently learned of suspicious computer activity on servers 
belonging to one of our vendors, which stored information about MLA’s current and former 
employees. The vendor notified MLA of this suspicious activity on February 14, 2014 and MLA 
immediately began investigating this incident. As a result of that investigation and further 
information provided by the vendor, it appears that some information related to current and 
former employees was accessed on November 28, 2013 (Thanksgiving Day), December 11, 

2013, and December 12, 2013 and that such access was obtained through the malicious and 
unauthorized access to the user identification and password of an account administrator. MLA 
has since reset all passwords for each user and asked all users to establish a new password. We 
are also working with our vendor to ensure that this does not occur again. 

Regrettably, our investigation appears to show that your personal information was accessed 
without authorization during this incident, including Federal Wage and Tax Statement Form W-2 
name, address, wages, taxes and Social Security number information; date of birth, age, gender, 
ethnicity; and Visa, Passport or Federal Form 1 9 documents numbers. We are notifying you so 
that you can take action to minimize or eliminate potential harm as a result. Because this is a 
serious incident, we strongly encourage you to take preventive measures now to help prevent and 
detect any misuse of your information. 

For example, as a preventive step, we recommend that you closely monitor your financial 
accounts and, if you see any unauthorized activity, promptly contact your financial institution. 

In the event you learn of an identity theft, you can submit a complaint with the Federal Trade 
Commission by calling 1 877 ID THEFT (1 877 438 4338), or through their website at 
https://ftccomDlaintassistant.gov . or by mail at Federal Trade Commission, Consumer Response 
Center, 600 Pennsylvania Avenue NW, Washington, D.C. 20580. Moreover, you may want to 
contact the three United States credit reporting agencies (Equifax, Experian, and TransUnion) to 
obtain a credit report. Free credit reports are available to all consumers every 12 months by 
calling 1-877-322-8228, or by logging on to www.annualcreditreport.com . Contact information 
for the three credit reporting agencies is as follows: 

TransUnion 
(800)680-7289 
P.O. Box 6790 
Fullerton, CA 92834-6790 
www.transunion.com 
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Equifax 
(800)525-6285 
P.O. Box 740241 
Atlanta, GA 30374 
www.equifax.com 


Experian 
(888)397-3742 
P.O. Box 9532 
Allen, TX 75013 
www.experian.com 


As an added precaution, MLA is providing you with one year of credit monitoring and identity 
theft protection at no cost to you. The service, provided by Experian, is called ProtectMyID. To 
activate these protections, simply: 

1. Ensure that you enroll by May 31 st , 2014 

2. Call 877-371 -7902 OR visit the ProtectMyID website: 
http://www.protectmvid.com/redeem 

3. Provide this activation code: [license code] 

Even if you do not find any suspicious activity on your initial credit reports, the Federal Trade 
Commission (FTC) recommends that you check your credit reports periodically. A victim’s 
personal information is sometimes held for use or shared among a group of thieves at different 
times. Checking your reports periodically can help you spot problems and address them quickly. 

In addition, you may obtain information from the FTC and the credit reporting agencies about 
fraud alerts and security freezes. You can add a fraud alert to your credit report file to help 
protect your credit information. A fraud alert can make it more difficult for someone to get 
credit in your name because it tells creditors to follow certain procedures to protect you, but it 
may also delay your ability to obtain credit. You may place a fraud alert in your file by calling 
just one of the three nationwide credit reporting agencies. 

We have also advised the three major United States credit reporting agencies about this incident, 
and have given those agencies a general report, alerting them to the fact that the incident 
occurred. However, we have not notified them about the presence of your particular information 
in the data breach. 


* * * 

For residents of Iowa, you may contact local law enforcement or the Iowa Attorney General’s 
Office to report suspected incidents of identity theft. You can contact the Iowa Attorney General 
at: Office of the Attorney General, 1305 E. Walnut Street, Des Moines, IA 50319 (515) 281 - 
5164 www.iowaattornevgeneral.aov . 

For residents of Maryland, you may obtain information about avoiding identity theft from the 
FTC or the Maryland Attorney General’s Office. You can contact the Maryland Attorney 
General at: Office of the Attorney General, Consumer Protection Divisions, 200 St. Paul Place, 
Baltimore, MD 21202 (888)743-0023 www.oag.state.md.us . 

For residents of Massachusetts, you have the right to obtain a police report in regard to this 
incident. If you are the victim of identity theft, you also have the right to file a police report and 
obtain a copy of it. Massachusetts law also requires that you be informed of the following 
procedure in order to obtain a security freeze on your credit report: If you have been the victim 
of identity theft, and you provide the credit reporting agency with a valid police report, you 
cannot be charged to place, lift or remove a security freeze. In other cases, a credit reporting 
agency may charge you up to $5.00 each to place, temporarily lift, or permanently remove a 
security freeze. To place a security freeze on your credit report, you must send a written request 
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to each of the three major credit reporting agencies, listed below, and you must provide the 
following information: Full name; Social Security Number; date of birth; if you have moved in 
the past five years, the addresses where you have lived for the prior five years; proof of current 
address, such as a utility bill; a legible photocopy of a government issued identification card, 
such as a driver’s license; if you have been the victim of identity theft, a copy of either the police 
report or complaint to law enforcement regarding identity theft; if you are not a victim of identity 
theft, payment by check, money order, or credit card. Do not send cash. 

To lift the security freeze in order to allow a specific entity or individual access to your credit 
report, you must call or send a written request to the credit reporting agencies by mail and 
include proper identification (name, address and Social Security number), as well as the PIN 
number or password provided to you when you placed the security freeze, as well as the 
identities of those entities or individuals you would like to receive your credit report, or the 
specific period of time you would like the credit report to be available. The credit reporting 
agencies have three business days after receiving your request to lift the security freeze for those 
identified entities or for the specified period of time. 

Likewise, to remove the security freeze, you must send a written request to each of the three 
credit reporting agencies by mail and include proper identification (name, address and Social 
Security number) and the PIN number or password provided to you when you placed the security 
freeze. After receiving your request, the credit reporting agencies have three business days to 
remove the security freeze. 

For residents of North Carolina, you may obtain information about avoiding identity theft from 
the FTC or the North Carolina Attorney General’s Office. You can contact the North Carolina 
Attorney General at: Consumer Protection Division, 9001 Mail Service Center, Raleigh, NC 
27699-9001 (877)566-7226 http://www.ncdoi.gov/ . 

* * * 


We want to stress that we genuinely regret any inconvenience or concern this incident may cause 
you. 


Jeff Haidet, Chairman 
McKenna Long & Aldridge LLP 
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From: (213) 688-1000 Origin ID: EMTA 1*1^ 

Raymond 0. Aghaian, Esq. 

McKenna Long & Aldridge LLP 
300 South Grand Ave Suite 1400 

Los Angeles, CA 90071 
_ J14101402070326 

SHIP TO: (213) 688-1000 X 36160 BILL SENDER 

Attorney General 
Office of the Attorney General 
Supreme Court Building 
207 West High Street 
JEFFERSON CITY, MO 65102 
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CAD: 101176641/INET3490 


Delivery Address Bar Code 



Ref# 099998.00146 
Invoice # 

PO# 


F?EC Eiuep 




p# 7980 7828 2620 

i 0201 1 


SH JEFA 


MON-03 MAR 10:30A 
PRIORITY OVERNIGHT 
ASR 

65102 

MO-US 

STL 




a < 
j/ 


K 




522G1/562F/F220 


After printing this label 

1. Use the 'Print' button on this page to print your label to your laser or inkjet printer. 

2. Fold the printed page along the horizontal line. 

3. Place label in shipping pouch and affix it to your shipment so that the barcode portion of the label can be read and scanned. 

Warning: Use only the printed original label for shipping. Using a photocopy of this label for shipping purposes is fraudulent and could 
result in additional billing charges, along with the cancellation of your FedEx account number. 

Use of this system constitutes your agreement to the service conditions in the current FedEx Service Guide, available on 
fedex.com. Fed Ex will not be responsible for any claim in excess of $100 per package, whether the result of loss, damage, delay, non- 
delivery,misdelivery,or misinformation, unless you declare a higher value, pay an additional charge, document your actual loss and file a 
timely claim.Limitations found in the current FedEx Service Guide apply. Your right to recover from FedEx for any loss, including intrinsic 
value of the package, loss of sales, income interest, profit, attorney's fees, costs, and other forms of damage whether direct, 
incidental,consequential, or special is limited to the greater of $100 or the authorized declared value. Recovery cannot exceed actual 
documented loss.Maximum for items of extraordinary value is $1,000, e.g. jewelry, precious metals, negotiable instruments and other 
items listed in our ServiceGuide. Written claims must be filed within strict time limits, see current FedEx Service Guide. 
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